                             :value    subject-pub}]]
         (is (= (set exts) (set exts-expected)))))
 
-    (testing "trusted fact extensions are copied from CSR"
+    (testing "trusted fact extensions are properly unfiltered"
       (let [csr-exts [(utils/puppet-node-image-name "imagename" false)
                       (utils/puppet-node-uid "UUUU-IIIII-DDD" false)]
             csr      (utils/generate-certificate-request

(ns puppetlabs.master.certificate-authority-test
  (:import (java.io StringReader ByteArrayInputStream)
           (java.security MessageDigest)
           (org.bouncycastle.asn1.x509 SubjectPublicKeyInfo))
  (:require [puppetlabs.master.certificate-authority :refer :all]
            [puppetlabs.trapperkeeper.testutils.logging :as logutils]
            [puppetlabs.certificate-authority.core :as utils]

        (is (= exts exts-expected))))

    (testing "only puppet extensions are copied from CSR to cert"
      (let [csr-exts [(utils/subject-dns-alt-names ["onefish"] false)
                      (utils/puppet-node-uid "AAAA-BBBB-CCCC-DDDD" false)]
            csr      (utils/generate-certificate-request
                       subject-keys subject-dn csr-exts)
            exts (create-agent-extensions csr issuer-pub)
